Qt wizard: bugfix: standardize_path in WCWalletName
What the developer wrote
Authored by ThomasV
Qt wizard: bugfix: standardize_path in WCWalletName
without this, any wallet that is not in the config
wallet_path cannot be open.
What changed, and why it matters
This is a small bugfix in Electrum's Qt wallet creation wizard. It makes sure wallet paths are stored in a consistent format so wallets located outside the default wallets folder can be opened. The change also renames a variable and updates comments, but does not add new security checks. It is a routine fix, not a security patch.
No security action required; treat as a normal functional bugfix. Reviewers may separately evaluate whether the noted path-traversal possibility needs hardening, but this commit does not address it.
Security signals we found
No security-relevant keywords in commit title or message
No new input validation or access control introduced
Comment explicitly notes that path-traversal inputs such as '..' are still possible
Change is a bugfix for opening wallets outside the default folder
Evidence from the diff
The commit imports standardize_path and applies it to the wizard’s stored _path. In WCWalletName.on_filename, the local parameter is renamed from filename to filename_or_path and a comment is reworded. The logic for joining the data-directory path and checking whether the resulting path is absolute remains essentially unchanged. No path sanitization or traversal mitigation is added.
Changed components
electrum/gui/qt/wizard/wallet.pyQENewWalletWizardWCWalletNameInspect captured patch +8 / −7
diff --git a/electrum/gui/qt/wizard/wallet.py b/electrum/gui/qt/wizard/wallet.py
index 67cc26f..6d0926b 100644
--- a/electrum/gui/qt/wizard/wallet.py
+++ b/electrum/gui/qt/wizard/wallet.py
@@ -17,7 +17,7 @@ from electrum.keystore import bip44_derivation, bip39_to_seed, purpose48_derivat
from electrum.plugin import run_hook, HardwarePluginLibraryUnavailable
from electrum.storage import StorageReadWriteError
from electrum.util import WalletFileException, get_new_wallet_name, UserFacingException, InvalidPassword
-from electrum.util import is_subpath, ChoiceItem, multisig_type, UserCancelled
+from electrum.util import is_subpath, ChoiceItem, multisig_type, UserCancelled, standardize_path
from electrum.wallet import wallet_types
from .wizard import QEAbstractWizard, WizardComponent
from electrum.logging import get_logger, Logger
@@ -92,7 +92,7 @@ class QENewWalletWizard(NewWalletWizard, QEAbstractWizard, MessageBoxMixin):
QEAbstractWizard.__init__(self, config, app, start_viewstate=start_viewstate)
self.window_title = _('Create/Restore wallet')
- self._path = path
+ self._path = standardize_path(path)
self._password = None
# attach gui classes to views
@@ -299,16 +299,17 @@ class WCWalletName(WalletWizardComponent, Logger):
if _path:
self.name_e.setText(relative_path(_path))
- def on_filename(filename):
- # FIXME? "filename" might contain ".." (etc) and hence sketchy path traversals are possible
+ def on_filename(filename_or_path):
+ # Note: "filename" might contain ".." (etc) and hence sketchy path traversals are possible
nonlocal temp_storage
temp_storage = None
msg = None
self.wallet_exists = False
self.wallet_is_open = False
self.wallet_needs_hw_unlock = False
- if filename:
- _path = os.path.join(datadir_wallet_folder, filename)
+ if filename_or_path:
+ # Note: if filename_or_path is a path, os.path.join will leave it unchanged
+ _path = os.path.join(datadir_wallet_folder, filename_or_path)
wallet_from_memory = self.wizard._daemon.get_wallet(_path)
try:
if wallet_from_memory:
@@ -345,7 +346,7 @@ class WCWalletName(WalletWizardComponent, Logger):
+ _("Press 'Finish' to create/focus window.")
if msg is None:
msg = _('Cannot read file')
- if filename and os.path.isabs(relative_path(_path)):
+ if filename_or_path and os.path.isabs(relative_path(_path)):
outside_text = _('Note: this wallet file is outside the default wallets folder.')
else:
outside_text = ''
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.